firehol-masquerade

title: firehol-masquerade(5)

text:
# firehol-masquerade(5)

## NAME
firehol-masquerade - set up masquerading (NAT) on an interface

## SYNOPSIS
masquerade real-interface rule-params

masquerade [reverse] rule-params

## DESCRIPTION
The masquerade helper command sets up masquerading on the output of a real network interface (as opposed to a FireHOL interface definition).

If a real-interface is specified the command should be used before any interface or router definitions. Multiple values can be given separated by whitespace, so long as they are enclosed in quotes.

If used within an interface definition the definition's real-interface will be used.

If used within a router definition the definition's outface(s) will be used, if specified. If the reverse option is given, then the definition's inface(s) will be used, if specified.

Unlike most commands, masquerade does not inherit its parent definition's rule-params, it only honours its own. The inface and outface parameters should not be used (iptables(8) does not support inface in the POSTROUTING chain and outface will be overwritten by FireHOL using the rules above).

Note

The masquerade always applies to the output of the chosen network interfaces.

FIREHOL_NAT will be turned on automatically (see firehol-defaults.conf(5) ) and FireHOL will enable packet-forwarding in the kernel.

## MASQUERADING AND SNAT
Masquerading is a special form of Source NAT (SNAT) that changes the source of requests when they go out and replaces their original source when they come in. This way a Linux host can become an Internet router for a LAN of clients having unroutable IP addresses. Masquerading takes care to re-map IP addresses and ports as required.

Masquerading is expensive compare to SNAT because it checks the IP address of the outgoing interface every time for every packet. If your host has a static IP address you should generally prefer SNAT.

## EXAMPLES

```
 # Before any interface or router
 masquerade eth0 src 192.0.2.0/24 dst not 192.0.2.0/24
 # In an interface definition to masquerade the output of its real-interface
 masquerade
 # In a router definition to masquerade the output of its outface
 masquerade
 # In a router definition to masquerade the output of its inface
 masquerade reverse
```

## SEE ALSO
•

firehol(1) - FireHOL program

•

firehol.conf(5) - FireHOL configuration

•

firehol-interface(5) - interface definition

•

firehol-router(5) - router definition

•

firehol-params(5) - optional rule parameters

•

firehol-nat(5) - nat, snat, dnat, redirect config helpers

•

FireHOL Website (http://firehol.org/)

•

FireHOL Online PDF Manual (http://firehol.org/firehol-manual.pdf)

•

FireHOL Online Documentation (http://firehol.org/documentation/)

## AUTHORS
FireHOL Team.


firehol-modifiers

package: firehol

title: firehol-modifiers(5)

summary: select IPv4 or IPv6 mode

text:
# firehol-modifiers(5)

## NAME
firehol-modifiers - select IPv4 or IPv6 mode

## SYNOPSIS
ipv4 definition-or-command argument...

ipv6 definition-or-command argument...

[both] definition-or-command argument...

## DESCRIPTION
When preceded by a modifier, any command or definition can be made to apply to IPv4 or IPv6 only.

Without a modifier, interface and router definitions and commands that come before either get applied to both IPv4 and IPV6.

Commands within an interface or router assume the same behaviour as the enclosing definition. You cannot create an IPv4 command within an IPv6 interface or router nor IPv6 within IPv4.

Examples:

```
 interface eth0 myboth src4 192.0.2.0/24 src6 2001:DB8::/24
   ipv4 server http accept
   ipv6 server http accept
 ipv4 interface eth0 my4only src 192.0.2.0/24
   server http accept
 ipv6 interface eth0 my6only src 2001:DB8::/24
   server http accept
```

Many definitions and commands have explicitly named variants (such as router4, router6, router46) which can be used as shorthand.

## SEE ALSO
•

firehol(1) - FireHOL program

•

firehol.conf(5) - FireHOL configuration

•

firehol-interface(5) - interface definition

•

firehol-router(5) - router definition

•

firehol-policy(5) - policy command

•

firehol-protection(5) - protection command

•

firehol-server(5) - server, route commands

•

firehol-client(5) - client command

•

firehol-group(5) - group command

•

firehol-iptables(5) - iptables helper

•

firehol-masquerade(5) - masquerade helper

•

FireHOL Website (http://firehol.org/)

•

FireHOL Online PDF Manual (http://firehol.org/firehol-manual.pdf)

•

FireHOL Online Documentation (http://firehol.org/documentation/)

## AUTHORS
FireHOL Team.


firehol-nat

title: firehol-nat(5)

summary: set up NAT and port redirections

text:
# firehol-nat(5)

## NAME
firehol-nat - set up NAT and port redirections

## SYNOPSIS
{ nat to-destination | dnat [to] } ipaddr[:port] [random] [persistent] [id id] [at chain] [rule-params]

{ nat to-source | snat [to] } ipaddr[:port] [random] [persistent] [id id] [at chain] [rule-params]

{ nat redirect-to | redirect [to] } port[-range] [random] [id id] [at chain] [rule-params]

## DESCRIPTION
Destination NAT is provided by nat to-destination and its synonym dnat.

Source NAT is provided by nat to-source and its synonym snat.

Redirection to a port on the local host is provided by nat redirect-to and its synonym redirect.

The port part of the new address is optional with SNAT and DNAT; if not specified it will not be changed.

When you apply NAT to a packet, the Linux kernel will track the changes it makes, so that when it sees replies the transformation will be applied in the opposite direction. For instance if you changed the destination port of a packet from 80 to 8080, when a reply comes back, its source is set as 80. This means the original sender is not aware a transformation is happening.

This means that NAT is only applied on the first packet of each connection (the nat FireHOL helper always appends state NEW to NAT statements).

The NAT helper can be used to setup load balancing. Check the section BALANCING below.

Note

The rule-params are used only to determine the traffic that will be matched for NAT in these commands, not to permit traffic to flow.

Applying NAT does not automatically create rules to allow the traffic to pass. You will still need to include client or server entries in an interface or router to allow the traffic.

When using dnat or redirect, the transformation is in the PREROUTING chain of the NAT table and happens before normal rules are matched, so your client or server rule should match the "modified" traffic.

When using snat, the transformation is in the POSTROUTING chain of the NAT table and happens after normal rules are matched, so your client or server rule should match the "unmodified" traffic.

See the netfilter flow diagram (http://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg) if you would like to see how network packets are processed by the kernel in detail.

The at keyword allows setting a different chain to attach the rules. For dnat and redirect the default is PREROUTING, but OUTPUT is also supported. For snat the default is POSTROUTING, but INPUT is also supported.

random will randomise the port mapping involved, to ensure the ports used are not predictable.

persistent is used when the statement is given alternatives (i.e. many destination servers for dnat, many source IPs for snat, many ports for redirect). It will attempt to keep each client on the same nat map. See below for more information about persistence.

The nat helper takes one of the following sub-commands:

to-destination ipaddr[:port]

Defines a Destination NAT (DNAT). Commonly thought of as port-forwarding (where packets destined for the firewall with a given port and protocol are sent to a different IP address and possibly port), DNAT is much more flexible in that any number of parameters can be matched before the destination information is rewritten.

ipaddr[:port] is the destination address to be set in packets matching rule-params.

If no rules are given, all forwarded traffic will be matched. outface should not be used in DNAT since the information is not available at the time the decision is made.

ipaddr[:port] accepts any --to-destination values that iptables(8) accepts. Run iptables -j DNAT --help for more information. Multiple ipaddr[:port] may be specified by separating with spaces and enclosing with quotes.

to-source ipaddr[:port]

Defines a Source NAT (SNAT). SNAT is similar to masquerading but is more efficient for static IP addresses. You can use it to give a public IP address to a host which does not have one behind the firewall. See also firehol-masquerade(5).

ipaddr[:port] is the source address to be set in packets matching rule-params.

If no rules are given, all forwarded traffic will be matched. inface should not be used in SNAT since the information is not available at the time the decision is made.

ipaddr[:port] accepts any --to-source values that iptables(8) accepts. Run iptables -j SNAT --help for more information. Multiple ipaddr[:port] may be specified by separating with spaces and enclosing with quotes.

redirect-to port[-range]

Redirect matching traffic to the local machine. This is typically useful if you want to intercept some traffic and process it on the local machine.

port[-range] is the port range (from-to) or single port that packets matching rule-params will be redirected to.

If no rules are given, all forwarded traffic will be matched. outface should not be used in REDIRECT since the information is not available at the time the decision is made.

## BALANCING
NAT can balance multiple servers (or IPs in case of snat) when a range is specified. This is handled by the kernel.

Example:

```
dnat4 to 10.0.0.1-10.0.0.10 persistent proto tcp dst 1.1.1.1 dport 80
```

In the above example, the Linux kernel will give a persistent server to all the sockets of any single client.

FireHOL can also setup balancing using a round-robin or weighted average distribution of requests. However persistent cannot be used (the Linux kernel applies persistence on a single NAT statement).

### Round Robin distribution
To enable round robin distribution, give multiple to values, space separated and enclosed in quotes, or comma separated.

Example:

```
 dnat4 to 10.0.0.1,10.0.0.2,10.0.0.3 proto tcp dst 1.1.1.1 port 80
 # or
 dnat4 to "10.0.0.1 10.0.0.2 10.0.0.3" proto tcp dst 1.1.1.1 port 80
```

Ports can also be given per IP:

```
 dnat4 to 10.0.0.1:70,10.0.0.2:80,10.0.0.3:90 proto tcp dst 1.1.1.1 port 80
 # or
 dnat4 to "10.0.0.1:70 10.0.0.2:80 10.0.0.3:90" proto tcp dst 1.1.1.1 port 80
```

### Weighted distribution
To enable weighted distribution, append a slash with the weight requested for each entry.

FireHOL adds all the weights given and calculates the percentage of traffic each entry should receive.

Example:

```
 dnat4 to 10.0.0.1/30,10.0.0.2/30,10.0.0.3/40 proto tcp dst 1.1.1.1 port 80
 # or
 dnat4 to "10.0.0.1/30 10.0.0.2/30 10.0.0.3/40" proto tcp dst 1.1.1.1 port 80
 # or
 dnat4 to 10.0.0.1:70/30,10.0.0.2:80/30,10.0.0.3:90/40 proto tcp dst 1.1.1.1 port 80
 # or
 dnat4 to "10.0.0.1:70/30 10.0.0.2:80/30 10.0.0.3:90/40" proto tcp dst 1.1.1.1 port 80
```

### PERSISTENCE
The kernel supports persistence only if the NAT alternatives are contiguous (i.e. dnat to A-B, snat to A-B, redirect to 1000:1010, etc). If they are contiguous, persistence is left at the kernel. FireHOL does nothing.

If the alternatives are not contiguous, FireHOL will use the recent iptables module to apply persistence itself.

FireHOL supports mixed mode persistence. For example, you can have something like this:

```
dnat to A-B/70,C-D/20,F/10 persistence id mybalancer
```

The above is a weighted distribution of persistence. Group A-B will get 70%, C-D 20% and server F 10%.

Using the above, FireHOL will apply its persistence to pick one of the groups A-B, or C-D, or F. Once the group has been picked by FireHOL, the kernel will apply persistence within the group, to pick the server that will handle the request.

The FireHOL persistence works like this:

1.

A packet is received that should be NATed

2.

A lookup is made using the recent module to find if it has been seen before. The source IP of packet is looked up.

3.

If it has been seen before, the connection is mapped the same way the last time was mapped. The recent module is updated too.

4.

If it has not been seen before, the connection is mapped using the distribution method specified. The recent module is updated too, to be ready for the next connection.

The recent module has a few limitations:

1.

It has lookup tables. We need one lookup table for each member of of the NAT. FireHOL uses the id parameter and the definition of each alternative in the NAT statement to form a name for the lookup table. These lookup tables are persistent to firewall restarts, this is why FireHOL requires from you to set an id.

2.

It can keep entries in its lookup tables for a given time. FireHOL sets this to 3600 seconds. You can control it by setting FIREHOL_NAT_PERSISTENCE_SECONDS.

3.

It has a limit on the number of entries in the lookup tables. FireHOL cannot set this. This is kernel module option. The default is 200 entries.

Check this:

~~~~ # modinfo xt_recent filename: /lib/modules/4.1.12-gentoo/kernel/net/netfilter/xt_recent.ko alias: ip6t_recent alias: ipt_recent license: GPL description: Xtables: "recently-seen" host matching author: Jan Engelhardt <jengelh@medozas.de> author: Patrick McHardy <kaber@trash.net> depends: x_tables intree: Y vermagic: 4.1.12-gentoo SMP preempt mod_unload modversions parm: ip_list_tot:number of IPs to remember per list (uint) parm: ip_list_hash_size:size of hash table used to look up IPs (uint) parm: ip_list_perms:permissions on /proc/net/xt_recent/* files (uint) parm: ip_list_uid:default owner of /proc/net/xt_recent/* files (uint) parm: ip_list_gid:default owning group of /proc/net/xt_recent/* files (uint) parm: ip_pkt_list_tot:number of packets per IP address to remember (max. 255) (uint) ~~~~

```
You have to consult your distribution documentation to set these.
You can find their current values by examining files found in
`/sys/module/xt_recent/parameters/` Unfortunately, these files
are not writable, so to change parameters you have unload and
reload the module (i.e. apply a firewall that does not use the
*recent* module, `rmmod xt_recent`, change the parameter,
re-apply a firewall that uses the *recent* module).
Normally, you will need a line in `/etc/modprobe.d/netfitler.conf`
like this:
~~~~
options xt_recent ip_list_tot=16384
~~~~
The number 16384 I used is the max number of unique client IPs
I expect to have per hour (`FIREHOL_NAT_PERSISTENCE_SECONDS`)
for this service.
`ip_list_hash_size` is calculated by kernel when the module
is loaded to be bigger and up to twice `ip_list_tot`.
```

Once you have the balancer running, you can find its lookup tables in /proc/net/xt_recent/. There you will find files starting with the id parameter, one file for every alternative of the NAT rule.

## EXAMPLES

```
 # Port forwarding HTTP
 dnat4 to 192.0.2.2 proto tcp dport 80
 # Port forwarding HTTPS on to a different port internally
 dnat4 to 192.0.2.2:4443 proto tcp dport 443
 # Fix source for traffic leaving the firewall via eth0 with private address
 snat4 to 198.51.100.1 outface eth0 src 192.168.0.0/24
 # Transparent squid (running on the firewall) for some hosts
 redirect4 to 8080 inface eth0 src 198.51.100.0/24 proto tcp dport 80
 # Send to 192.0.2.1
 #  - all traffic arriving at or passing through the firewall
 nat4 to-destination 192.0.2.1
 # Send to 192.0.2.1
 #  - all traffic arriving at or passing through the firewall
 #  - which WAS going to 203.0.113.1
 nat4 to-destination 192.0.2.1 dst 203.0.113.1
 # Send to 192.0.2.1
 #  - TCP traffic arriving at or passing through the firewall
 #  - which WAS going to 203.0.113.1
 nat4 to-destination 192.0.2.1 proto tcp dst 203.0.113.1
 # Send to 192.0.2.1
 #  - TCP traffic arriving at or passing through the firewall
 #  - which WAS going to 203.0.113.1, port 25
 nat4 to-destination 192.0.2.1 proto tcp dport 25 dst 203.0.113.1
```

## SEE ALSO
•

firehol(1) - FireHOL program

•

firehol.conf(5) - FireHOL configuration

•

firehol-interface(5) - interface definition

•

firehol-router(5) - router definition

•

firehol-params(5) - optional rule parameters

•

firehol-masquerade(5) - masquerade helper

•

FireHOL Website (http://firehol.org/)

•

FireHOL Online PDF Manual (http://firehol.org/firehol-manual.pdf)

•

FireHOL Online Documentation (http://firehol.org/documentation/)

•

NAT HOWTO (http://www.netfilter.org/documentation/HOWTO/NAT-HOWTO-6.html)

•

netfilter flow diagram (http://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg)

## AUTHORS
FireHOL Team.


firehol-params

title: firehol-params(5)

summary: optional rule parameters

text:
# firehol-params(5)

## NAME
firehol-params - optional rule parameters

## SYNOPSIS
Common

{ src | src4 | src6 } [not] host

{ dst | dst4 | dst6 } [not] host

srctype [not] type

dsttype [not] type

proto [not] protocol

mac [not] macaddr

dscp [not] value class classid

mark [not] id

connmark [not] id

custommark [not] name id

rawmark [not] id

tos [not] id

custom "iptables-options..."

custom-in "iptables-options..."

custom-out "iptables-options..."

Router Only

inface [not] interface

outface [not] interface

physin [not] interface

physout [not] interface

Interface Only

uid [not] user

gid [not] group

Logging

connlog "log text"

log "log text" [level loglevel]

loglimit "log text" [level loglevel]

Helpers Only

sport port

dport port

state state

ipset [not] name flags [no-counters] [bytes-lt|bytes-eq|bytes-gt|bytes-not-eq number] [packets-lt|packets-eq|packets-gt|packets-not-eq number] [options custom-ipset-options]

limit limit burst

connlimit upto|above limit [mask mask] [saddr|daddr]

hashlimit name upto|above amount/period [burst amount] [mode {srcip|srcport|dstip|dstport},...] [srcmask prefix] [dstmask prefix] [htable-size buckets] [htable-max entries] [htable-expire msec] [htable-gcinterval msec]

## DESCRIPTION
Optional rule parameters are accepted by many commands to narrow the match they make. Not all parameters are accepted by all commands so you should check the individual commands for exclusions.

All matches are made against the REQUEST. FireHOL automatically sets up the necessary stateful rules to deal with replies in the reverse direction.

All matches should be true for a statement to be executed. However, many matches support multiple values. In this case, at least one of the values must match.

Example:

```
server smtp accept src 1.1.1.1 dst 2.2.2.2
```

In the above example all smtp requests coming in from 1.1.1.1 and going out to smtp server 2.2.2.2 will be matched.

```
server smtp accept src 1.1.1.1 dst 2.2.2.2,3.3.3.3
```

In the above example all smtp requests coming in from 1.1.1.1 and going out to either smtp server 2.2.2.2 or 3.3.3.3 will be matched.

Use the keyword not to match any value other than the one(s) specified.

The logging parameters are unusual in that they do not affect the match, they just cause a log message to be emitted. Therefore, the logging parameters don't support the not option.

FireHOL is designed so that if you specify a parameter that is also used internally by the command then a warning will be issued (and the internal version will be used).

## COMMON

### src, dst
Use src and dst to define the source and destination IP addresses of the request respectively. host defines the IP or IPs to be matched.

host can also refer to an ipset, using this syntax: ipset:NAME, where NAME is the name of the ipset. The ipset has to be of type hash:ip for this match to work. The source IP or the destination IP will be used for the match, depending if the ipset is given as src or dst.

IPs and ipsets can be mixed together, like this: src 1.1.1.1,ipset:NAME1,2.2.2.2,ipset:NAME2

Examples:

```
server4 smtp accept src not 192.0.2.1
server4 smtp accept dst 198.51.100.1
server4 smtp accept src not 192.0.2.1 dst 198.51.100.1
server6 smtp accept src not 2001:DB8:1::/64
server6 smtp accept dst 2001:DB8:2::/64
server6 smtp accept src not 2001:DB8:1::/64 dst 2001:DB8:2::/64
```

When attempting to create rules for both IPv4 and IPv6 it is generally easier to use the src4, src6, dst4 and dst6 pairs:

```
server46 smtp accept src4 192.0.2.1 src6 2001:DB8:1::/64
server46 smtp accept dst4 198.51.100.1 dst6 2001:DB8:2::/64
server46 smtp accept dst4 $d4 dst6 $d6 src4 not $d4 src6 not $s6
```

To keep the rules sane, if one of the 4/6 pair specifies not, then so must the other. If you do not want to use both IPv4 and IPv6 addresses, you must specify the rule as IPv4 or IPv6 only. It is always possible to write a second IPv4 or IPv6 only rule.

### srctype, dsttype
Use srctype or dsttype to define the source or destination IP address type of the request. type is the address type category as used in the kernel's network stack. It can be one of:

UNSPEC

an unspecified address (i.e. 0.0.0.0)

UNICAST

a unicast address

LOCAL

a local address

BROADCAST

a broadcast address

ANYCAST

an anycast address

MULTICAST

a multicast address

BLACKHOLE

a blackhole address

UNREACHABLE

an unreachable address

PROHIBIT

a prohibited address

THROW; NAT; XRESOLVE

undocumented

See iptables(8) or run iptables -m addrtype --help for more information. Examples:

```
server smtp accept srctype not "UNREACHABLE PROHIBIT"

```

### proto
Use proto to match by protocol. The protocol can be any accepted by iptables(8).

### mac
Use mac to match by MAC address. The macaddr matches to the "remote" host. In an interface, "remote" always means the non-local host. In a router, "remote" refers to the source of requests for servers. It refers to the destination of requests for clients. Examples:

```
 # Only allow pop3 requests to the e6 host
 client pop3 accept mac 00:01:01:00:00:e6
 # Only allow hosts other than e7/e8 to access smtp
 server smtp accept mac not "00:01:01:00:00:e7 00:01:01:00:00:e8"
```

### dscp
Use dscp to match the DSCP field on packets. For details on DSCP values and classids, see firehol-dscp(5).

```
 server smtp accept dscp not "0x20 0x30"
 server smtp accept dscp not class "BE EF"
```

### mark
Use mark to match marks set on packets. For details on mark ids, see firehol-mark(5).

```
server smtp accept mark not "20 55"

```

### tos
Use tos to match the TOS field on packets. For details on TOS ids, see firehol-tos(5).

```
server smtp accept tos not "Maximize-Throughput 0x10"

```

### custom
Use custom to pass arguments directly to iptables(8). All of the parameters must be in a single quoted string. To pass an option to iptables(8) that itself contains a space you need to quote strings in the usual bash(1) manner. For example:

```
server smtp accept custom "--some-option some-value"
server smtp accept custom "--some-option 'some-value second-value'"
```

## ROUTER ONLY

### inface, outface
Use inface and outface to define the interface via which a request is received and forwarded respectively. Use the same format as firehol-interface(5). Examples:

```
server smtp accept inface not eth0
server smtp accept inface not "eth0 eth1"
server smtp accept inface eth0 outface eth1
```

### physin, physout
Use physin and physout to define the physical interface via which a request is received or send in cases where the inface or outface is known to be a virtual interface; e.g. a bridge. Use the same format as firehol-interface(5). Examples:

```
server smtp accept physin not eth0

```

## INTERFACE ONLY
These parameters match information related to information gathered from the local host. They apply only to outgoing packets and are silently ignored for incoming requests and requests that will be forwarded.

Note

The Linux kernel infrastructure to match PID/SID and executable names with pid, sid and cmd has been removed so these options can no longer be used.

### uid
Use uid to match the operating system user sending the traffic. The user is a username, uid number or a quoted list of the two.

For example, to limit which users can access POP3 and IMAP by preventing replies for certain users from being sent:

```
client "pop3 imap" accept user not "user1 user2 user3"

```

Similarly, this will allow all requests to reach the server but prevent replies unless the web server is running as apache:

```
server http accept user apache

```

### gid
Use gid to match the operating system group sending the traffic. The group is a group name, gid number or a quoted list of the two.

## LOGGING

### connlog
Use connlog to log only the first packet of a connection.

### log, loglimit
Use log or loglimit to log matching packets to syslog. Unlike iptables(8) logging, this is not an action: FireHOL will produce multiple iptables(8) commands to accomplish both the action for the rule and the logging.

Logging is controlled using the FIREHOL_LOG_OPTIONS and FIREHOL_LOG_LEVEL environment variables - see firehol-defaults.conf(5). loglimit additionally honours the FIREHOL_LOG_FREQUENCY and FIREHOL_LOG_BURST variables.

Specifying level (which takes the same values as FIREHOL_LOG_LEVEL) allows you to override the log level for a single rule.

## HELPERS ONLY PARAMETERS

### dport, sport
FireHOL also provides dport, sport and limit which are used internally and rarely needed within configuration files.

dport and sport require an argument port which can be a name, number, range (FROM:TO) or a quoted list of ports.

For dport port specifies the destination port of a request and can be useful when matching traffic to helper commands (such as nat) where there is no implicit port.

For sport port specifies the source port of a request and can be useful when matching traffic to helper commands (such as nat) where there is no implicit port.

### limit
limit requires the arguments frequency and burst and will limit the matching of traffic in both directions.

### connlimit
connlimit matches on the number of connections per IP. It has been added to FireHOL since v3.

saddr matches on source IP. daddr matches on destination IP. mask groups IPs with the mask given upto matches when the number of connections is up to the given limit above matches when the number of connections above to the given limit

The number of connections counted are system wide, not service specific. For example for saddr, you cannot connlimit 2 connections for SSH and 4 for SMTP. If you connlimit 2 connections for SSH, then the first 2 connections of a client can be SSH. If a client has already 2 connections to another service, the client will not be able to connect to SSH.

So, connlimit can safely be used:

•

with daddr to limit the connections a server can accept

•

with saddr to limit the total connections per client to all services.

### hashlimit
hashlimit has been added to FireHOL since v3.

hashlimit hashlimit uses hash buckets to express a rate limiting match (like the limit match) for a group of connections using a single iptables rule. Grouping can be done per-hostgroup (source and/or destination address) and/or per-port. It gives you the ability to express "N packets per time quantum per group" or "N bytes per seconds" (see below for some examples).

A hash limit type (upto, above) and name are required.

name The name for the /proc/net/ipt_hashlimit/name entry.

upto amount[/second|/minute|/hour|/day] Match if the rate is below or equal to amount/quantum. It is specified either as a number, with an optional time quantum suffix (the default is 3/hour), or as amountb/second (number of bytes per second).

above amount[/second|/minute|/hour|/day] Match if the rate is above amount/quantum.

burst amount Maximum initial number of packets to match: this number gets recharged by one every time the limit specified above is not reached, up to this number; the default is 5. When byte-based rate matching is requested, this option specifies the amount of bytes that can exceed the given rate. This option should be used with caution - if the entry expires, the burst value is reset too.

mode {srcip|srcport|dstip|dstport},... A comma-separated list of objects to take into consideration. If no mode option is given, srcip,dstport is assumed.

srcmask prefix When --hashlimit-mode srcip is used, all source addresses encountered will be grouped according to the given prefix length and the so-created subnet will be subject to hashlimit. prefix must be between (inclusive) 0 and 32. Note that srcmask 0 is basically doing the same thing as not specifying srcip for mode, but is technically more expensive.

dstmask prefix Like srcmask, but for destination addresses.

htable-size buckets The number of buckets of the hash table

htable-max entries Maximum entries in the hash.

htable-expire msec After how many milliseconds do hash entries expire.

htable-gcinterval msec How many milliseconds between garbage collection intervals.

Examples:

matching on source host: "1000 packets per second for every host in 192.168.0.0/16"

```
src 192.168.0.0/16 hashlimit mylimit mode srcip upto 1000/sec
```

matching on source port: "100 packets per second for every service of 192.168.1.1"

```
src 192.168.1.1 hashlimit mylimit mode srcport upto 100/sec
```

matching on subnet: "10000 packets per minute for every /28 subnet (groups of 8 addresses) in 10.0.0.0/8"

```
src 10.0.0.8 hashlimit mylimit mask 28 upto 10000/min
```

matching bytes per second: "flows exceeding 512kbyte/s"

```
hashlimit mylimit mode srcip,dstip,srcport,dstport above 512kb/s
```

matching bytes per second: "hosts that exceed 512kbyte/s, but permit up to 1Megabytes without matching"

```
hashlimit mylimit mode dstip above 512kb/s burst 1mb
```

## SEE ALSO
•

firehol(1) - FireHOL program

•

firehol.conf(5) - FireHOL configuration

•

firehol-server(5) - server, route commands

•

firehol-client(5) - client command

•

firehol-interface(5) - interface definition

•

firehol-router(5) - router definition

•

firehol-mark(5) - mark config helper

•

firehol-tos(5) - tos config helper

•

firehol-dscp(5) - dscp config helper

•

firehol-defaults.conf(5) - control variables

•

iptables(8) (http://ipset.netfilter.org/iptables.man.html) - administration tool for IPv4 firewalls

•

ip6tables(8) (http://ipset.netfilter.org/ip6tables.man.html) - administration tool for IPv6 firewalls

•

FireHOL Website (http://firehol.org/)

•

FireHOL Online PDF Manual (http://firehol.org/firehol-manual.pdf)

•

FireHOL Online Documentation (http://firehol.org/documentation/)

## AUTHORS
FireHOL Team.


firehol-policy

title: firehol-policy(5)

text:
# firehol-policy(5)

## NAME
firehol-policy - set default action for an interface or router

## SYNOPSIS
policy action

## DESCRIPTION
The policy subcommand defines the default policy for an interface or router.

The action can be any of the actions listed in firehol-actions(5).

Note

Change the default policy of a router only if you understand clearly what will be matched by the router statement whose policy is being changed.

It is common to define overlapping router definitions. Changing the policy to anything other than the default return may cause strange results for your configuration.

Warning

Do not set a policy to accept unless you fully trust all hosts that can reach the interface. FireHOL CANNOT be used to create valid "accept by default" firewalls.

## EXAMPLE

```
interface eth0 intranet src 192.0.2.0/24
  # I trust this interface absolutely
  policy accept
```

## SEE ALSO
•

firehol(1) - FireHOL program

•

firehol.conf(5) - FireHOL configuration

•

firehol-interface(5) - interface definition

•

firehol-router(5) - router definition

•

FireHOL Website (http://firehol.org/)

•

FireHOL Online PDF Manual (http://firehol.org/firehol-manual.pdf)

•

FireHOL Online Documentation (http://firehol.org/documentation/)

## AUTHORS
FireHOL Team.


firehol-protection

title: firehol-protection(5)

summary: add extra protections to a definition

text:
# firehol-protection(5)

## NAME
firehol-protection - add extra protections to a definition

## SYNOPSIS
protection [reverse] strong [requests/period [burst]]

protection [reverse] flood-protection-type [requests/period [burst]]

protection [reverse] { bad-packets | packet-protection-type }

protection [reverse] connlimit connections [mask prefix]

protection [reverse] connrate rate [burst amount] [srcmask prefix] [htable-size buckets] [htable-max entries] [htable-expire msec] [htable-gcinterval msec]

## DESCRIPTION
The protection subcommand sets protection rules on an interface or router.

Flood protections honour the values requests/period and burst. They are used to limit the rate of certain types of traffic.

The default rate FireHOL uses is 100 operations per second with a burst of 50. Run iptables -m limit --help for more information.

The protection type strong will switch on all protections (both packet and flood protections) except all-floods. It has aliases full and all.

The protection type bad-packets will switch on all packet protections but not flood protections.

You can specify multiple protection types by using multiple protection commands or by using a single command and enclosing the types in quotes.

Note

On a router, protections are normally set up on inface.

The reverse option will set up the protections on outface. You must use it as the first keyword.

## PACKET PROTECTION TYPES
bad-packets:

Drops all the bad packets detected by these rules.

invalid

Drops all incoming invalid packets, as detected INVALID by the connection tracker.

See also FIREHOL_DROP_INVALID in firehol-defaults.conf(5) which allows setting this function globally.

fragments

Drops all packet fragments.

This rule will probably never match anything since iptables(8) reconstructs all packets automatically before the firewall rules are processed whenever connection tracking is running.

new-tcp-w/o-syn

Drops all TCP packets that initiate a socket but have not got the SYN flag set.

malformed-xmas

Drops all TCP packets that have all TCP flags set.

malformed-null

Drops all TCP packets that have all TCP flags unset.

malformed-bad

Drops all TCP packets that have illegal combinations of TCP flags set.

### EXAMPLES

```
protection bad-packets
```

## FLOOD PROTECTION TYPES
icmp-floods [requests/period [burst]]

Allows only a certain amount of ICMP echo requests.

syn-floods [requests/period [burst]]

Allows only a certain amount of new TCP connections.

Be careful to not set the rate too low as the rule is applied to all connections regardless of their final result (rejected, dropped, established, etc).

all-floods [requests/period [burst]]

Allows only a certain amount of new connections.

Be careful to not set the rate too low as the rule is applied to all connections regardless of their final result (rejected, dropped, established, etc).

### EXAMPLES

```
protection all-floods 90/sec 40
```

## CLIENT LIMITING TYPES
These protections were added in v3.

These protections are used to limit the connections client make, per interface or router.

They support appending optional rule parameters to limit their scope to certain clients only.

protection [reverse] connlimit connections [mask

prefix] Allow only a number of connections per client (implemented with connlimit with fixed type=saddr).

protection [reverse] connrate rate [burst amount]

[srcmask prefix] [htable-size buckets] [htable-max entries] [htable-expire msec] [htable-gcinterval msec] Allow up to a rate of new connections per client (implemented with hashlimit with fixed type=upto and mode=srcip).

### EXAMPLES
Limit the number of concurrent connections to 10 per client

```
protection connlimit 10 mask 32
```

Limit the number of concurrent connections to 100 per client class-C and also limit it to 5 for 1.2.3.4

```
protection connlimit 100 mask 24
protection connlimit 5 src 1.2.3.4
```

In the last example above, if you want to give client 1.2.3.4 more connections than all others, you should exclude it from the first connlimit statement, like this:

```
protection connlimit 100 mask 24 src not 1.2.3.4
protection connlimit 200 src 1.2.3.4
```

Limit all clients to 10 concurrect connections and 60 connections/minute

```
protection connlimit 10
protection connrate 60/minute
```

## KNOWN ISSUES
When using multiple types in a single command, if the quotes are forgotten, incorrect rules will be generated without warning.

When using multiple types in a single command, FireHOL will silently ignore any types that come after a group type (bad-packets, strong and its aliases). Only use group types on their own line.

## SEE ALSO
•

firehol(1) - FireHOL program

•

firehol.conf(5) - FireHOL configuration

•

firehol-interface(5) - interface definition

•

firehol-router(5) - router definition

•

FireHOL Website (http://firehol.org/)

•

FireHOL Online PDF Manual (http://firehol.org/firehol-manual.pdf)

•

FireHOL Online Documentation (http://firehol.org/documentation/)

## AUTHORS
FireHOL Team.


firehol-proxy

title: firehol-proxy(5)

text:
# firehol-proxy(5)

## NAME
firehol-proxy - set up a transparent TCP, HTTP or squid proxy

## SYNOPSIS
transparent_proxy service port user rule-params

transparent_squid port user rule-params

## DESCRIPTION
The transparent_proxy helper command sets up transparent caching for TCP traffic.

The transparent_squid helper command sets up the special case for HTTP traffic with service implicitly set to 80.

Note

The proxy application must be running on the firewall host at port port with the credentials of the local user user (which may be a space-delimited list enclosed in quotes) serving requests appropriate to the TCP port service.

The rule-params define a set of rule parameters to define the traffic that is to be proxied. See firehol-params(5) for more details.

For traffic destined for the firewall host or passing through the firewall, do not use the outface parameter because the rules are applied before the routing decision and so the outgoing interface will not be known.

An empty user string ("") disables caching of locally-generated traffic. Otherwise, traffic starting from the firewall is captured, except that traffic generated by the local user(s) user. The inface, outface and src rule-params are all ignored for locally-generated traffic.

## EXAMPLES

```
transparent_proxy 80 3128 squid inface eth0 src 192.0.2.0/24
transparent_squid 3128 squid inface eth0 src 192.0.2.0/24
transparent_proxy "80 3128 8080" 3128 "squid privoxy root bin" \
      inface not "ppp+ ipsec+" dst not "a.not.proxied.server"
transparent_squid "80 3128 8080" "squid privoxy root bin" \
      inface not "ppp+ ipsec+" dst not "non.proxied.server"
```

## SEE ALSO
•

firehol(1) - FireHOL program

•

firehol.conf(5) - FireHOL configuration

•

firehol-interface(5) - interface definition

•

firehol-router(5) - router definition

•

firehol-params(5) - optional rule parameters

•

firehol-nat(5) - nat, snat, dnat, redirect config helpers

•

FireHOL Website (http://firehol.org/)

•

FireHOL Online PDF Manual (http://firehol.org/firehol-manual.pdf)

•

FireHOL Online Documentation (http://firehol.org/documentation/)

## AUTHORS
FireHOL Team.


firehol-router

title: firehol-router(5)

text:
# firehol-router(5)

## NAME
firehol-server - server, route commands: accept requests to a service

## SYNOPSIS
{ server | server46 } service action rule-params

server4 service action rule-params

server6 service action rule-params

{ route | route46 } service action rule-params

route4 service action rule-params

route6 service action rule-params

## DESCRIPTION
The server subcommand defines a server of a service on an interface or router. Any rule-params given to a parent interface or router are inherited by the server.

For FireHOL a server is the destination of a request. Even though this is more complex for some multi-socket services, to FireHOL a server always accepts requests.

The route subcommand is an alias for server which may only be used in routers.

The service parameter is one of the supported service names from firehol-services(5). Multiple services may be specified, space delimited in quotes.

The action can be any of the actions listed in firehol-actions(5).

The rule-params define a set of rule parameters to further restrict the traffic that is matched to this service. See firehol-params(5) for more details.

Note

Writing server4 is equivalent to writing ipv4 server and ensures this subcommand is applied only in the IPv4 firewall rules.

Writing server6 is equivalent to writing ipv6 server and ensures this subcommand is applied only in the IPv6 firewall rules.

Writing server46 is equivalent to writing both server and ensures this subcommand is applied in both the IPv4 and IPv6 firewall rules; it cannot be used as part an interface or router that is IPv4 or IPv6 only.

The default server inherits its behaviour from the enclosing interface or router.

The same rules apply to the variations of route.

## EXAMPLES

```
server smtp accept
server "smtp pop3" accept
server smtp accept src 192.0.2.1
server smtp accept log "mail packet" src 192.0.2.1
```

## SEE ALSO
•

firehol(1) - FireHOL program

•

firehol.conf(5) - FireHOL configuration

•

firehol-modifiers(5) - ipv4/ipv6 selection

•

firehol-services(5) - services list

•

firehol-actions(5) - actions for rules

•

firehol-params(5) - optional rule parameters

•

firehol-client(5) - client subcommand

•

firehol-interface(5) - interface definition

•

firehol-router(5) - router definition

•

FireHOL Website (http://firehol.org/)

•

FireHOL Online PDF Manual (http://firehol.org/firehol-manual.pdf)

•

FireHOL Online Documentation (http://firehol.org/documentation/)

## AUTHORS
FireHOL Team.


firehol-server

title: firehol-server(5)

text:
# firehol-server(5)

## NAME
firehol-server - server, route commands: accept requests to a service

## SYNOPSIS
{ server | server46 } service action rule-params

server4 service action rule-params

server6 service action rule-params

{ route | route46 } service action rule-params

route4 service action rule-params

route6 service action rule-params

## DESCRIPTION
The server subcommand defines a server of a service on an interface or router. Any rule-params given to a parent interface or router are inherited by the server.

For FireHOL a server is the destination of a request. Even though this is more complex for some multi-socket services, to FireHOL a server always accepts requests.

The route subcommand is an alias for server which may only be used in routers.

The service parameter is one of the supported service names from firehol-services(5). Multiple services may be specified, space delimited in quotes.

The action can be any of the actions listed in firehol-actions(5).

The rule-params define a set of rule parameters to further restrict the traffic that is matched to this service. See firehol-params(5) for more details.

Note

Writing server4 is equivalent to writing ipv4 server and ensures this subcommand is applied only in the IPv4 firewall rules.

Writing server6 is equivalent to writing ipv6 server and ensures this subcommand is applied only in the IPv6 firewall rules.

Writing server46 is equivalent to writing both server and ensures this subcommand is applied in both the IPv4 and IPv6 firewall rules; it cannot be used as part an interface or router that is IPv4 or IPv6 only.

The default server inherits its behaviour from the enclosing interface or router.

The same rules apply to the variations of route.

## EXAMPLES

```
server smtp accept
server "smtp pop3" accept
server smtp accept src 192.0.2.1
server smtp accept log "mail packet" src 192.0.2.1
```

## SEE ALSO
•

firehol(1) - FireHOL program

•

firehol.conf(5) - FireHOL configuration

•

firehol-modifiers(5) - ipv4/ipv6 selection

•

firehol-services(5) - services list

•

firehol-actions(5) - actions for rules

•

firehol-params(5) - optional rule parameters

•

firehol-client(5) - client subcommand

•

firehol-interface(5) - interface definition

•

firehol-router(5) - router definition

•

FireHOL Website (http://firehol.org/)

•

FireHOL Online PDF Manual (http://firehol.org/firehol-manual.pdf)

•

FireHOL Online Documentation (http://firehol.org/documentation/)

## AUTHORS
FireHOL Team.


firehol-services

title: firehol-services(5)

summary: FireHOL services list

text:
# firehol-services(5)

## NAME
firehol-services - FireHOL services list

## SYNOPSIS
AH all amanda any anystateless apcupsd apcupsdnis aptproxy asterisk

cups custom cvspserver

darkstat daytime dcc dcpp dhcp dhcprelay dhcpv6 dict distcc dns

echo emule eserver ESP

finger ftp

gift giftui gkrellmd GRE

h323 heartbeat http httpalt https hylafax

iax iax2 ICMP icmp ICMPV6 icmpv6 icp ident imap imaps ipsecnatt ipv6error ipv6mld ipv6neigh ipv6router irc isakmp

jabber jabberd

l2tp ldap ldaps lpd

microsoft_ds mms msn msnp ms_ds multicast mysql

netbackup netbios_dgm netbios_ns netbios_ssn nfs nis nntp nntps nrpe ntp nut nxserver

openvpn oracle OSPF

ping pop3 pop3s portmap postgres pptp privoxy

radius radiusold radiusoldproxy radiusproxy rdp rndc rsync rtp

samba sane sip smtp smtps snmp snmptrap socks squid ssh stun submission sunrpc swat syslog

telnet tftp time timestamp tomcat

upnp uucp

vmware vmwareauth vmwareweb vnc

webcache webmin whois

xbox xdmcp

## DESCRIPTION

### service: AH
IPSec Authentication Header (AH)

Example:

```
  server AH accept

```

Service Type:

•

simple

Server Ports:

•

51/any

Client Ports:

•

any

Links

•

Wikipedia (http://en.wikipedia.org/wiki/IPsec#Authentication_Header)

Notes

For more information see this Archive of the FreeS/WAN documentation (http://web.archive.org/web/20100918134143/http://www.freeswan.org/freeswan_trees/freeswan-1.99/doc/ipsec.html#AH.ipsec) and RFC 2402 (http://www.ietf.org/rfc/rfc2402.txt).

### service: all
Match all traffic

Example:

```
  server all accept

```

Service Type:

•

simple

Server Ports:

•

all

Client Ports:

•

all

Netfilter Modules

•

nf_conntrack_ftp CONFIG_NF_CONNTRACK_FTP (http://cateee.net/lkddb/web-lkddb/NF_CONNTRACK_FTP.html)

•

nf_conntrack_irc CONFIG_NF_CONNTRACK_IRC (http://cateee.net/lkddb/web-lkddb/NF_CONNTRACK_IRC.html)

•

nf_conntrack_sip CONFIG_NF_CONNTRACK_SIP (http://cateee.net/lkddb/web-lkddb/NF_CONNTRACK_SIP.html)

•

nf_conntrack_pptp CONFIG_NF_CONNTRACK_PPTP (http://cateee.net/lkddb/web-lkddb/NF_CONNTRACK_PPTP.html)

•

nf_conntrack_proto_gre CONFIG_NF_CT_PROTO_GRE (http://cateee.net/lkddb/web-lkddb/NF_CT_PROTO_GRE.html)

Netfilter NAT Modules

•

nf_nat_ftp CONFIG_NF_NAT_FTP (http://cateee.net/lkddb/web-lkddb/NF_NAT_FTP.html)

•

nf_nat_irc CONFIG_NF_NAT_IRC (http://cateee.net/lkddb/web-lkddb/NF_NAT_IRC.html)

•

nf_nat_sip CONFIG_NF_NAT_SIP (http://cateee.net/lkddb/web-lkddb/NF_NAT_SIP.html)

•

nf_nat_pptp CONFIG_NF_NAT_PPTP (http://cateee.net/lkddb/web-lkddb/NF_NAT_PPTP.html)

•

nf_nat_proto_gre CONFIG_NF_NAT_PROTO_GRE (http://cateee.net/lkddb/web-lkddb/NF_NAT_PROTO_GRE.html)

Notes

Matches all traffic (all protocols, ports, etc.). Note that to provide "connections in one direction with replies" semantics, the kernel connection tracker is still used: this will therefore still not match packets if they are not understood as part of a connection (e.g. some ICMPv6 packets, requests and replies taking different routes, complex protocols with no helper loaded).

This service may indirectly setup a set of other services, if they require kernel modules to be loaded. The following complex services are activated:

### service: amanda
Advanced Maryland Automatic Network Disk Archiver

Service Type:

•

simple

Server Ports:

•

udp/10080

Client Ports:

•

default

Netfilter Modules

•

nf_conntrack_amanda CONFIG_NF_CONNTRACK_AMANDA (http://cateee.net/lkddb/web-lkddb/NF_CONNTRACK_AMANDA.html)

Netfilter NAT Modules

•

nf_nat_amanda CONFIG_NF_NAT_AMANDA (http://cateee.net/lkddb/web-lkddb/NF_NAT_AMANDA.html)

Links

•

Homepage (http://www.amanda.org/)

•

Wikipedia (http://en.wikipedia.org/wiki/Advanced_Maryland_Automatic_Network_Disk_Archiver)

### service: any
Match all traffic (without modules or indirect)

Example:

```
  server any *myname* accept proto 47

```

Service Type:

•

simple

Server Ports:

•

all

Client Ports:

•

all

Notes

Matches all traffic (all protocols, ports, etc), but does not care about kernel modules and does not activate any other service indirectly. In combination with the firehol-params(5) this service can match unusual traffic (e.g. GRE - protocol 47).

Note that you have to supply your own name in addition to "any".

### service: anystateless
Match all traffic statelessly

Example:

```
  server anystateless *myname* accept proto 47

```

Service Type:

•

complex

Server Ports:

•

all

Client Ports:

•

all

Notes

Matches all traffic (all protocols, ports, etc), but does not care about kernel modules and does not activate any other service indirectly. In combination with the firehol-params(5) this service can match unusual traffic (e.g. GRE - protocol 47).

This service is identical to "any" but does not care about the state of traffic.

Note that you have to supply your own name in addition to "anystateless".

### service: apcupsd
APC UPS Daemon

Example:

```
  server apcupsd accept

```

Service Type:

•

simple

Server Ports:

•

tcp/6544

Client Ports:

•

default

Links

•

Homepage (http://www.apcupsd.com)

•

Wikipedia (http://en.wikipedia.org/wiki/Apcupsd)

Notes

This service must be defined as "server apcupsd accept" on all machines not directly connected to the UPS (i.e. slaves).

Note that the port defined here is not the default port (6666) used if you download and compile APCUPSD, since the default conflicts with IRC and many distributions (like Debian) have changed this to 6544.

You can define port 6544 in APCUPSD, by changing the value of NETPORT in its configuration file, or overwrite this FireHOL service definition using the procedures described in Adding Services in firehol.conf(5).

### service: apcupsdnis
APC UPS Daemon Network Information Server

Example:

```
  server apcupsdnis accept

```

Service Type:

•

simple

Server Ports:

•

tcp/3551

Client Ports:

•

default

Links

•

Homepage (http://www.apcupsd.com)

•

Wikipedia (http://en.wikipedia.org/wiki/Apcupsd)

Notes

This service allows the remote WEB interfaces of APCUPSD (http://www.apcupsd.com/), to connect and get information from the server directly connected to the UPS device.

### service: aptproxy
Advanced Packaging Tool Proxy

Example:

```
  server aptproxy accept

```

Service Type:

•

simple

Server Ports:

•

tcp/9999

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Apt-proxy)

### service: asterisk
Asterisk PABX

Example:

```
  server asterisk accept

```

Service Type:

•

simple

Server Ports:

•

tcp/5038

Client Ports:

•

default

Links

•

Homepage (http://www.asterisk.org)

•

Wikipedia (http://en.wikipedia.org/wiki/Asterisk_PBX)

Notes

This service refers only to the manager interface of asterisk. You should normally enable sip, h323, rtp, etc. at the firewall level, if you enable the relative channel drivers of asterisk.

### service: cups
Common UNIX Printing System

Example:

```
  server cups accept

```

Service Type:

•

simple

Server Ports:

•

tcp/631 udp/631

Client Ports:

•

any

Links

•

Homepage (http://www.cups.org)

•

Wikipedia (http://en.wikipedia.org/wiki/Common_Unix_Printing_System)

### service: custom
Custom definitions

Example:

```
  server custom myimap tcp/143 default accept

```

Service Type:

•

custom

Server Ports:

•

N/A

Client Ports:

•

N/A

Notes

The full syntax is:

subcommand custom name svr-proto/ports cli-ports action params

This service is used by FireHOL to allow you create rules for services which do not have a definition.

subcommand, action and params have their usual meanings.

A name must be supplied along with server ports in the form proto/range and client ports which takes only a range.

To define services with the built-in extension mechanism to avoid the need for custom services, see Adding Services in firehol.conf(5).

### service: cvspserver
Concurrent Versions System

Example:

```
  server cvspserver accept
```

Service Type:

•

simple

Server Ports:

•

tcp/2401

Client Ports:

•

default

Links

•

Homepage (http://www.nongnu.org/cvs/)

•

Wikipedia (http://en.wikipedia.org/wiki/Concurrent_Versions_System)

### service: darkstat
Darkstat network traffic analyser

Example:

```
  server darkstat accept
```

Service Type:

•

simple

Server Ports:

•

tcp/666

Client Ports:

•

default

Links

•

Homepage (https://unix4lyfe.org/darkstat/)

### service: daytime
Daytime Protocol

Example:

```
  server daytime accept
```

Service Type:

•

simple

Server Ports:

•

tcp/13

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Daytime_Protocol)

### service: dcc
Distributed Checksum Clearinghouse

Example:

```
  server dcc accept
```

Service Type:

•

simple

Server Ports:

•

udp/6277

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Distributed_Checksum_Clearinghouse)

Notes

See also this DCC FAQ (http://www.rhyolite.com/dcc/FAQ.html#firewall-ports).

### service: dcpp
Direct Connect++ P2P

Example:

```
  server dcpp accept
```

Service Type:

•

simple

Server Ports:

•

tcp/1412 udp/1412

Client Ports:

•

default

Links

•

Homepage (http://dcplusplus.sourceforge.net)

### service: dhcp
Dynamic Host Configuration Protocol

Example:

```
  server dhcp accept
```

Service Type:

•

complex

Server Ports:

•

udp/67

Client Ports:

•

68

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Dhcp)

Notes

The dhcp service is implemented as stateless rules.

DHCP clients broadcast to the network (src 0.0.0.0 dst 255.255.255.255) to find a DHCP server. If the DHCP service was stateful the iptables connection tracker would not match the packets and deny to send the reply.

Note that this change does not affect the security of either DHCP servers or clients, since only the specific ports are allowed (there is no random port at either the server or the client side).

Note also that the "server dhcp accept" or "client dhcp accept" commands should placed within interfaces that do not have src and / or dst defined (because of the initial broadcast).

You can overcome this problem by placing the DHCP service on a separate interface, without a src or dst but with a policy return. Place this interface before the one that defines the rest of the services.

For example:

interface eth0 dhcp

policy return

server dhcp accept

interface eth0 lan src "$mylan" dst "$myip"

client all accept

For example: interface eth0 dhcp policy return server dhcp accept interface eth0 lan src "$mylan" dst "$myip" client all accept

This service implicitly sets its client or server to ipv4 mode.

### service: dhcprelay
DHCP Relay

Example:

```
  server dhcprelay accept
```

Service Type:

•

simple

Server Ports:

•

udp/67

Client Ports:

•

67

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol#DHCP_relaying)

Notes

From RFC 1812 section 9.1.2:

In many cases, BOOTP clients and their associated BOOTP server(s) do not reside on the same IP (sub)network. In such cases, a third-party agent is required to transfer BOOTP messages between clients and servers. Such an agent was originally referred to as a BOOTP forwarding agent. However, to avoid confusion with the IP forwarding function of a router, the name BOOTP relay agent has been adopted instead.

For more information about DHCP Relay see section 9.1.2 of RFC 1812 (http://www.ietf.org/rfc/rfc1812.txt) and section 4 of RFC 1542 (http://www.ietf.org/rfc/rfc1542.txt)

### service: dhcpv6
Dynamic Host Configuration Protocol for IPv6

Example:

```
  server dhcp accept
  client dhcp accept
```

Service Type:

•

complex

Server Ports:

•

udp/547

Client Ports:

•

udp/546

Links

•

Wikipedia (https://en.wikipedia.org/wiki/DHCPv6)

Notes

The dhcp service is implemented as stateless rules. It cannot be stateful as the connection tracker will not match a unicast reply to a broadcast request. Further, if you wish to add src/dst rule parameters, you must account for both the broadcast and link-local network prefixes.

Clients broadcast from a link-local address to the multicast address ff02::1:2 on UDP port 547 to find a server. The server sends a unicast reply back to the client which listens on UDP port 546.

For a FireHOL interface, creating a client will allow sending to port 547 and receiving on port 546. Creating a server allows sending to port 546 and receiving on port 547.

Unlike DHCP for IPv4, the source ports to be used are not defined in DHCPv6 - see section 5.2 of RFC3315 (http://www.ietf.org/rfc/rfc3315.txt). Some servers are known to make use of this to send from arbitrary ports, so FireHOL does not assume a source port.

This service implicitly sets its client or server to ipv6 mode.

### service: dict
Dictionary Server Protocol

Example:

```
  server dict accept
```

Service Type:

•

simple

Server Ports:

•

tcp/2628

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/DICT)

Notes

See RFC2229 (http://www.ietf.org/rfc/rfc2229.txt).

### service: distcc
Distributed CC

Example:

```
  server distcc accept
```

Service Type:

•

simple

Server Ports:

•

tcp/3632

Client Ports:

•

default

Links

•

Homepage (https://code.google.com/p/distcc/)

•

Wikipedia (http://en.wikipedia.org/wiki/Distcc)

Notes

For distcc security, please check the distcc security design (http://distcc.googlecode.com/svn/trunk/doc/web/security.html).

### service: dns
Domain Name System

Example:

```
  server dns accept
```

Service Type:

•

simple

Server Ports:

•

udp/53 tcp/53

Client Ports:

•

any

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Domain_Name_System)

Notes

On very busy DNS servers you may see a few dropped DNS packets in your logs. This is normal. The iptables connection tracker will timeout the session and lose unmatched DNS packets that arrive too late to be useful.

### service: echo
Echo Protocol

Example:

```
  server echo accept
```

Service Type:

•

simple

Server Ports:

•

tcp/7

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Echo_Protocol)

### service: emule
eMule (Donkey network client)

Example:

```
  client emule accept src 192.0.2.1
```

Service Type:

•

complex

Server Ports:

•

many

Client Ports:

•

many

Links

•

Homepage (http://www.emule-project.com)

Notes

According to eMule Port Definitions (http://www.emule-project.net/home/perl/help.cgi?l=1&rm=show_topic&topic_id=122), FireHOL defines:

•

Accept from any client port to the server at tcp/4661

•

Accept from any client port to the server at tcp/4662

•

Accept from any client port to the server at udp/4665

•

Accept from any client port to the server at udp/4672

•

Accept from any server port to the client at tcp/4662

•

Accept from any server port to the client at udp/4672

Use the FireHOL firehol-client(5) command to match the eMule client.

Please note that the eMule client is an HTTP client also.

### service: eserver
eDonkey network server

Example:

```
  server eserver accept
```

Service Type:

•

simple

Server Ports:

•

tcp/4661 udp/4661 udp/4665

Client Ports:

•

any

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Eserver)

### service: ESP
IPSec Encapsulated Security Payload (ESP)

Example:

```
  server ESP accept
```

Service Type:

•

simple

Server Ports:

•

50/any

Client Ports:

•

any

Links

•

Wikipedia (http://en.wikipedia.org/wiki/IPsec#Encapsulating_Security_Payload)

Notes

For more information see this Archive of the FreeS/WAN documentation (http://web.archive.org/web/20100918134143/http://www.freeswan.org/freeswan_trees/freeswan-1.99/doc/ipsec.html#ESP.ipsec) RFC 2406 (http://www.ietf.org/rfc/rfc2406.txt).

### service: finger
Finger Protocol

Example:

```
  server finger accept
```

Service Type:

•

simple

Server Ports:

•

tcp/79

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Finger_protocol)

### service: ftp
File Transfer Protocol

Example:

```
  server ftp accept
```

Service Type:

•

simple

Server Ports:

•

tcp/21

Client Ports:

•

default

Netfilter Modules

•

nf_conntrack_ftp CONFIG_NF_CONNTRACK_FTP (http://cateee.net/lkddb/web-lkddb/NF_CONNTRACK_FTP.html)

Netfilter NAT Modules

•

nf_nat_ftp CONFIG_NF_NAT_FTP (http://cateee.net/lkddb/web-lkddb/NF_NAT_FTP.html)

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Ftp)

Notes

The FTP service matches both active and passive FTP connections.

### service: gift
giFT Internet File Transfer

Example:

```
  server gift accept
```

Service Type:

•

simple

Server Ports:

•

tcp/4302 tcp/1214 tcp/2182 tcp/2472

Client Ports:

•

any

Links

•

Homepage (http://gift.sourceforge.net)

•

Wikipedia (http://en.wikipedia.org/wiki/GiFT)

Notes

The gift FireHOL service supports:

•

Gnutella listening at tcp/4302

•

FastTrack listening at tcp/1214

•

OpenFT listening at tcp/2182 and tcp/2472

The above ports are the defaults given for the corresponding giFT modules.

To allow access to the user interface ports of giFT, use the giftui.

### service: giftui
giFT Internet File Transfer User Interface

Example:

```
  server giftui accept
```

Service Type:

•

simple

Server Ports:

•

tcp/1213

Client Ports:

•

default

Links

•

Homepage (http://gift.sourceforge.net)

•

Wikipedia (http://en.wikipedia.org/wiki/GiFT)

Notes

This service refers only to the user interface ports offered by giFT. To allow gift accept P2P requests, use the gift.

### service: gkrellmd
GKrellM Daemon

Example:

```
  server gkrellmd accept
```

Service Type:

•

simple

Server Ports:

•

tcp/19150

Client Ports:

•

default

Links

•

Homepage (http://gkrellm.net/)

•

Wikipedia (http://en.wikipedia.org/wiki/Gkrellm)

### service: GRE
Generic Routing Encapsulation

Example:

```
  server GRE accept
```

Service Type:

•

simple

Server Ports:

•

47/any

Client Ports:

•

any

Netfilter Modules

•

nf_conntrack_proto_gre CONFIG_NF_CT_PROTO_GRE (http://cateee.net/lkddb/web-lkddb/NF_CT_PROTO_GRE.html)

Netfilter NAT Modules

•

nf_nat_proto_gre CONFIG_NF_NAT_PROTO_GRE (http://cateee.net/lkddb/web-lkddb/NF_NAT_PROTO_GRE.html)

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Generic_Routing_Encapsulation)

Notes

Protocol No 47.

For more information see RFC RFC 2784 (http://www.ietf.org/rfc/rfc2784.txt).

### service: h323
H.323 VoIP

Example:

```
  server h323 accept
```

Service Type:

•

simple

Server Ports:

•

udp/1720 tcp/1720

Client Ports:

•

default

Netfilter Modules

•

nf_conntrack_h323 CONFIG_NF_CONNTRACK_H323 (http://cateee.net/lkddb/web-lkddb/NF_CONNTRACK_H323.html)

Netfilter NAT Modules

•

nf_nat_h323 CONFIG_NF_NAT_H323 (http://cateee.net/lkddb/web-lkddb/NF_NAT_H323.html)

Links

•

Wikipedia (http://en.wikipedia.org/wiki/H323)

### service: heartbeat
HeartBeat

Example:

```
  server heartbeat accept
```

Service Type:

•

simple

Server Ports:

•

udp/690:699

Client Ports:

•

default

Links

•

Homepage (http://www.linux-ha.org/)

Notes

This FireHOL service has been designed such a way that it will allow multiple heartbeat clusters on the same LAN.

### service: http
Hypertext Transfer Protocol

Example:

```
  server http accept
```

Service Type:

•

simple

Server Ports:

•

tcp/80

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Http)

### service: httpalt
HTTP alternate port

Example:

```
  server httpalt accept
```

Service Type:

•

simple

Server Ports:

•

tcp/8080

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Http)

Notes

This port is commonly used by web servers, web proxies and caches where the standard http port is not available or can or should not be used.

### service: https
Secure Hypertext Transfer Protocol

Example:

```
  server https accept
```

Service Type:

•

simple

Server Ports:

•

tcp/443

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Https)

### service: hylafax
HylaFAX

Example:

```
  server hylafax accept
```

Service Type:

•

complex

Server Ports:

•

many

Client Ports:

•

many

Links

•

Homepage (http://www.hylafax.org/)

•

Wikipedia (http://en.wikipedia.org/wiki/Hylafax)

Notes

This service allows incoming requests to server port tcp/4559 and outgoing from server port tcp/4558.

The correct operation of this service has not been verified.

USE THIS WITH CARE. A HYLAFAX CLIENT MAY OPEN ALL TCP UNPRIVILEGED PORTS TO ANYONE (from port tcp/4558).

### service: iax
Inter-Asterisk eXchange

Example:

```
  server iax accept
```

Service Type:

•

simple

Server Ports:

•

udp/5036

Client Ports:

•

default

Links

•

Homepage (http://www.asterisk.org)

•

Wikipedia (http://en.wikipedia.org/wiki/Iax)

Notes

This service refers to IAX version 1. There is also iax2.

### service: iax2
Inter-Asterisk eXchange v2

Example:

```
  server iax2 accept
```

Service Type:

•

simple

Server Ports:

•

udp/5469 udp/4569

Client Ports:

•

default

Links

•

Homepage (http://www.asterisk.org)

•

Wikipedia (http://en.wikipedia.org/wiki/Iax)

Notes

This service refers to IAX version 2. There is also iax.

### service: ICMP
Internet Control Message Protocol

Example:

```
  server ICMP accept
```

Service Type:

•

simple

Server Ports:

•

icmp/any

Client Ports:

•

any

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol)

### service: icmp
Internet Control Message Protocol

Alias for ICMP

### service: ICMPV6
Internet Control Message Protocol v6

Example:

```
  server ICMPV6 accept
```

Service Type:

•

simple

Server Ports:

•

icmpv6/any

Client Ports:

•

any

Links

•

Wikipedia (http://en.wikipedia.org/wiki/ICMPv6)

### service: icmpv6
Internet Control Message Protocol v6

Alias for ICMPV6

### service: icp
Internet Cache Protocol

Example:

```
  server icp accept
```

Service Type:

•

simple

Server Ports:

•

udp/3130

Client Ports:

•

3130

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Internet_Cache_Protocol)

### service: ident
Identification Protocol

Example:

```
  server ident reject with tcp-reset
```

Service Type:

•

simple

Server Ports:

•

tcp/113

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Ident_protocol)

### service: imap
Internet Message Access Protocol

Example:

```
  server imap accept
```

Service Type:

•

simple

Server Ports:

•

tcp/143

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Imap)

### service: imaps
Secure Internet Message Access Protocol

Example:

```
  server imaps accept
```

Service Type:

•

simple

Server Ports:

•

tcp/993

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Imap)

### service: ipsecnatt
NAT traversal and IPsec

Service Type:

•

simple

Server Ports:

•

udp/4500

Client Ports:

•

any

Links

•

Wikipedia (http://en.wikipedia.org/wiki/NAT_traversal#IPsec_traversal_across_NAT)

### service: ipv6error
ICMPv6 Error Handling

Example:

```
  server ipv6error accept
```

Service Type:

•

complex

Server Ports:

•

N/A

Client Ports:

•

N/A

Notes

This service is not needed from 3.0.0. It will do nothing but issue a warning from 3.1.0; it will be removed in 4.0.0.

The linux connection tracker ensures that ICMPv6 errors are marked as RELATED. Since 3.0.0, these are automatially accepted by FireHOL, making a separate command redundant.

### service: ipv6mld
IPv6 Multicast Listener Discovery for IPv6

Example:

```
  client ipv6mld accept
```

Service Type:

•

complex

Server Ports:

•

N/A

Client Ports:

•

N/A

Links

•

Wikipedia (https://en.wikipedia.org/wiki/Multicast_Listener_Discovery)

Notes

IPv6 uses Multicast Listener Discovery to discover multicast listeners and what they are listening for.

In practice all IPv6 nodes are multicast listeners since multicast is used in the neighbour discovery protocol which replaces ARP in IPv4.

These rules are stateless since reports can happen automatically as well as on query.

Unless muticast snooping is disabled across the network, MLD should be enabled for any clients:

client ipv6mld accept

MLD should also be enabled as a server on any hosts acting as a router:

server ipv6mld accept

The rules should generally not be used to pass packets across a firewall (e.g. in a router definition) unless the firewall is for a bridge.

This service implicitly sets its client or server to ipv6 mode.

### service: ipv6neigh
IPv6 Neighbour discovery

Example:

```
  client ipv6neigh accept
  server ipv6neigh accept
```

Service Type:

•

complex

Server Ports:

•

N/A

Client Ports:

•

N/A

Links

•

Wikipedia (https://en.wikipedia.org/wiki/Neighbor_Discovery_Protocol)

Notes

IPv6 uses the Neighbour Discovery Protocol to do automatic configuration of routes and to replace ARP. To allow this functionality the network neighbour and router solicitation/advertisement messages should be enabled on each interface.

These rules are stateless since advertisement can happen automatically as well as on solicitation.

Neighbour discovery (incoming) should always be enabled:

server ipv6neigh accept

Neighbour advertisement (outgoing) should always be enabled:

client ipv6neigh accept

The rules should not be used to pass packets across a firewall (e.g. in a router definition) unless the firewall is for a bridge.

This service implicitly sets its client or server to ipv6 mode.

### service: ipv6router
IPv6 Router discovery

Example:

```
  client ipv6router accept
```

Service Type:

•

complex

Server Ports:

•

N/A

Client Ports:

•

N/A

Links

•

Wikipedia (https://en.wikipedia.org/wiki/Neighbor_Discovery_Protocol)

Notes

IPv6 uses the Neighbour Discovery Protocol to do automatic configuration of routes and to replace ARP. To allow this functionality the network neighbour and router solicitation/advertisement messages should be enabled on each interface.

These rules are stateless since advertisement can happen automatically as well as on solicitation.

Router discovery (incoming) should always be enabled:

client ipv6router accept

Router advertisement (outgoing) should be enabled on a host that routes:

server ipv6router accept

The rules should not be used to pass packets across a firewall (e.g. in a router definition) unless the firewall is for a bridge.

This service implicitly sets its client or server to ipv6 mode.

### service: irc
Internet Relay Chat

Example:

```
  server irc accept
```

Service Type:

•

simple

Server Ports:

•

tcp/6667

Client Ports:

•

default

Netfilter Modules

•

nf_conntrack_irc CONFIG_NF_CONNTRACK_IRC (http://cateee.net/lkddb/web-lkddb/NF_CONNTRACK_IRC.html)

Netfilter NAT Modules

•

nf_nat_irc CONFIG_NF_NAT_IRC (http://cateee.net/lkddb/web-lkddb/NF_NAT_IRC.html)

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Internet_Relay_Chat)

### service: isakmp
Internet Security Association and Key Management Protocol (IKE)

Example:

```
  server isakmp accept
```

Service Type:

•

simple

Server Ports:

•

udp/500

Client Ports:

•

any

Links

•

Wikipedia (http://en.wikipedia.org/wiki/ISAKMP)

Notes

For more information see the Archive of the FreeS/WAN documentation (http://web.archive.org/web/20100918134143/http://www.freeswan.org/freeswan_trees/freeswan-1.99/doc/ipsec.html#IKE.ipsec)

### service: jabber
Extensible Messaging and Presence Protocol

Example:

```
  server jabber accept
```

Service Type:

•

simple

Server Ports:

•

tcp/5222 tcp/5223

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Jabber)

Notes

Allows clear and SSL client-to-server connections.

### service: jabberd
Extensible Messaging and Presence Protocol (Server)

Example:

```
  server jabberd accept
```

Service Type:

•

simple

Server Ports:

•

tcp/5222 tcp/5223 tcp/5269

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Jabber)

Notes

Allows clear and SSL client-to-server and server-to-server connections.

Use this service for a jabberd server. In all other cases, use the jabber.

### service: l2tp
Layer 2 Tunneling Protocol

Service Type:

•

simple

Server Ports:

•

udp/1701

Client Ports:

•

any

Links

•

Wikipedia (http://en.wikipedia.org/wiki/L2tp)

### service: ldap
Lightweight Directory Access Protocol

Example:

```
  server ldap accept
```

Service Type:

•

simple

Server Ports:

•

tcp/389

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Ldap)

### service: ldaps
Secure Lightweight Directory Access Protocol

Example:

```
  server ldaps accept
```

Service Type:

•

simple

Server Ports:

•

tcp/636

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Ldap)

### service: lpd
Line Printer Daemon Protocol

Example:

```
  server lpd accept
```

Service Type:

•

simple

Server Ports:

•

tcp/515

Client Ports:

•

any

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Line_Printer_Daemon_protocol)

Notes

LPD is documented in RFC 1179 (http://www.ietf.org/rfc/rfc1179.txt).

Since many operating systems incorrectly use the non-default client ports for LPD access, this definition allows any client port to access the service (in addition to the RFC defined 721 to 731 inclusive).

### service: microsoft_ds
Direct Hosted (NETBIOS-less) SMB

Example:

```
  server microsoft_ds accept
```

Service Type:

•

simple

Server Ports:

•

tcp/445

Client Ports:

•

default

Notes

Direct Hosted (i.e. NETBIOS-less SMB)

This is another NETBIOS Session Service with minor differences with netbios_ssn. It is supported only by Windows 2000 and Windows XP and it offers the advantage of being independent of WINS for name resolution.

It seems that samba supports transparently this protocol on the netbios_ssn ports, so that either direct hosted or traditional SMB can be served simultaneously.

Please refer to the netbios_ssn for more information.

### service: mms
Microsoft Media Server

Example:

```
  server mms accept
```

Service Type:

•

simple

Server Ports:

•

tcp/1755 udp/1755

Client Ports:

•

default

Netfilter Modules

•

See here (http://www.netfilter.org/documentation/HOWTO/netfilter-extensions-HOWTO-5.html#ss5.5).

Netfilter NAT Modules

•

See here (http://www.netfilter.org/documentation/HOWTO/netfilter-extensions-HOWTO-5.html#ss5.5).

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Microsoft_Media_Server)

Notes

Microsoft's proprietary network streaming protocol used to transfer unicast data in Windows Media Services (previously called NetShow Services).

### service: msn
Microsoft MSN Messenger Service

Example:

```
  server msn accept
```

Service Type:

•

simple

Server Ports:

•

tcp/1863 udp/1863

Client Ports:

•

default

### service: msnp
msnp

Example:

```
  server msnp accept
```

Service Type:

•

simple

Server Ports:

•

tcp/6891

Client Ports:

•

default

### service: ms_ds
Direct Hosted (NETBIOS-less) SMB

Alias for microsoft_ds

### service: multicast
Multicast

Example:

```
  server multicast reject with proto-unreach
```

Service Type:

•

complex

Server Ports:

•

N/A

Client Ports:

•

N/A

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Multicast)

Notes

The multicast service matches all packets sent to the $MULTICAST_IPS addresses using IGMP or UDP. For IPv4 that means 224.0.0.0/4 and for IPv6 FF00::/16.

### service: mysql
MySQL

Example:

```
  server mysql accept
```

Service Type:

•

simple

Server Ports:

•

tcp/3306

Client Ports:

•

default

Links

•

Homepage (http://www.mysql.com/)

•

Wikipedia (http://en.wikipedia.org/wiki/Mysql)

### service: netbackup
Veritas NetBackup service

Example:

```
  server netbackup accept
  client netbackup accept
```

Service Type:

•

simple

Server Ports:

•

tcp/13701 tcp/13711 tcp/13720 tcp/13721 tcp/13724 tcp/13782 tcp/13783

Client Ports:

•

any

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Netbackup)

Notes

To use this service you must define it as both client and server in NetBackup clients and NetBackup servers.

### service: netbios_dgm
NETBIOS Datagram Distribution Service

Example:

```
  server netbios_dgm accept
```

Service Type:

•

simple

Server Ports:

•

udp/138

Client Ports:

•

any

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Netbios#Datagram_distribution_service)

Notes

See also the samba.

Keep in mind that this service broadcasts (to the broadcast address of your LAN) UDP packets. If you place this service within an interface that has a dst parameter, remember to include (in the dst parameter) the broadcast address of your LAN too.

### service: netbios_ns
NETBIOS Name Service

Example:

```
  server netbios_ns accept
```

Service Type:

•

simple

Server Ports:

•

udp/137

Client Ports:

•

any

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Netbios#Name_service)

Notes

See also the samba.

### service: netbios_ssn
NETBIOS Session Service

Example:

```
  server netbios_ssn accept
```

Service Type:

•

simple

Server Ports:

•

tcp/139

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Netbios#Session_service)

Notes

See also the samba.

Please keep in mind that newer NETBIOS clients prefer to use port 445 (microsoft_ds) for the NETBIOS session service, and when this is not available they fall back to port 139 (netbios_ssn). Versions of samba above 3.x bind automatically to ports 139 and 445.

If you have an older samba version and your policy on an interface or router is DROP, clients trying to access port 445 will have to timeout before falling back to port 139. This timeout can be up to several minutes.

To overcome this problem you can explicitly REJECT the microsoft_ds with a tcp-reset message:

server microsoft_ds reject with tcp-reset

### service: nfs
Network File System

Example:

```
  client nfs accept dst 192.0.2.1
```

Service Type:

•

complex

Server Ports:

•

many

Client Ports:

•

N/A

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Network_File_System_%28protocol%29)

Notes

The NFS service queries the RPC service on the NFS server host to find out the ports nfsd, mountd, lockd and rquotad are listening. Then, according to these ports it sets up rules on all the supported protocols (as reported by RPC) in order the clients to be able to reach the server.

For this reason, the NFS service requires that:

•

the firewall is restarted if the NFS server is restarted

•

the NFS server must be specified on all nfs statements (only if it is not the localhost)

Since NFS queries the remote RPC server, it is required to also be allowed to do so, by allowing the portmap too. Take care that this is allowed by the running firewall when FireHOL tries to query the RPC server. So you might have to setup NFS in two steps: First add the portmap service and activate the firewall, then add the NFS service and restart the firewall.

To avoid this you can setup your NFS server to listen on pre-defined ports, as documented in NFS Howto (http://nfs.sourceforge.net/nfs-howto/ar01s06.html#nfs_firewalls). If you do this then you will have to define the the ports using the procedure described in Adding Services in firehol.conf(5).

### service: nis
Network Information Service

Example:

```
  client nis accept dst 192.0.2.1
```

Service Type:

•

complex

Server Ports:

•

many

Client Ports:

•

N/A

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Network_Information_Service)

Notes

The nis service queries the RPC service on the nis server host to find out the ports ypserv and yppasswdd are listening. Then, according to these ports it sets up rules on all the supported protocols (as reported by RPC) in order the clients to be able to reach the server.

For this reason, the nis service requires that:

•

the firewall is restarted if the nis server is restarted

•

the nis server must be specified on all nis statements (only if it is not the localhost)

Since nis queries the remote RPC server, it is required to also be allowed to do so, by allowing the portmap too. Take care that this is allowed by the running firewall when FireHOL tries to query the RPC server. So you might have to setup nis in two steps: First add the portmap service and activate the firewall, then add the nis service and restart the firewall.

This service was added to FireHOL by Carlos Rodrigues (http://sourceforge.net/p/firehol/feature-requests/20/). His comments regarding this implementation, are:

These rules work for client access only!

Pushing changes to slave servers won't work if these rules are active somewhere between the master and its slaves, because it is impossible to predict the ports where yppush will be listening on each push.

Pulling changes directly on the slaves will work, and could be improved performance-wise if these rules are modified to open fypxfrd. This wasn't done because it doesn't make that much sense since pushing changes on the master server is the most common, and recommended, way to replicate maps.

### service: nntp
Network News Transfer Protocol

Example:

```
  server nntp accept
```

Service Type:

•

simple

Server Ports:

•

tcp/119

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Nntp)

### service: nntps
Secure Network News Transfer Protocol

Example:

```
  server nntps accept
```

Service Type:

•

simple

Server Ports:

•

tcp/563

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Nntp)

### service: nrpe
Nagios NRPE

Service Type:

•

simple

Server Ports:

•

tcp/5666

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Nagios#NRPE)

### service: ntp
Network Time Protocol

Example:

```
  server ntp accept
```

Service Type:

•

simple

Server Ports:

•

udp/123 tcp/123

Client Ports:

•

any

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Network_Time_Protocol)

### service: nut
Network UPS Tools

Example:

```
  server nut accept
```

Service Type:

•

simple

Server Ports:

•

tcp/3493 udp/3493

Client Ports:

•

default

Links

•

Homepage (http://www.networkupstools.org/)

### service: nxserver
NoMachine NX Server

Example:

```
  server nxserver accept
```

Service Type:

•

simple

Server Ports:

•

tcp/5000:5200

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/NX_Server)

Notes

Default ports used by NX server for connections without encryption.

Note that nxserver also needs the ssh to be enabled.

This information has been extracted from this The TCP ports used by nxserver are 4000 + DISPLAY_BASE to 4000 + DISPLAY_BASE + DISPLAY_LIMIT. DISPLAY_BASE and DISPLAY_LIMIT are set in /usr/NX/etc/node.conf and the defaults are DISPLAY_BASE=1000 and DISPLAY_LIMIT=200.

For encrypted nxserver sessions, only ssh is needed.

### service: openvpn
OpenVPN

Service Type:

•

simple

Server Ports:

•

tcp/1194 udp/1194

Client Ports:

•

default

Links

•

Homepage (http://openvpn.net/)

•

Wikipedia (http://en.wikipedia.org/wiki/OpenVPN)

### service: oracle
Oracle Database

Example:

```
  server oracle accept
```

Service Type:

•

simple

Server Ports:

•

tcp/1521

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Oracle_db)

### service: OSPF
Open Shortest Path First

Example:

```
  server OSPF accept
```

Service Type:

•

simple

Server Ports:

•

89/any

Client Ports:

•

any

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Ospf)

### service: ping
Ping (ICMP echo)

Example:

```
  server ping accept
```

Service Type:

•

complex

Server Ports:

•

N/A

Client Ports:

•

N/A

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Ping)

Notes

This services matches requests of protocol ICMP and type echo-request (TYPE=8) and their replies of type echo-reply (TYPE=0).

The ping service is stateful.

### service: pop3
Post Office Protocol

Example:

```
  server pop3 accept
```

Service Type:

•

simple

Server Ports:

•

tcp/110

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Pop3)

### service: pop3s
Secure Post Office Protocol

Example:

```
  server pop3s accept
```

Service Type:

•

simple

Server Ports:

•

tcp/995

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Pop3)

### service: portmap
Open Network Computing Remote Procedure Call - Port Mapper

Example:

```
  server portmap accept
```

Service Type:

•

simple

Server Ports:

•

udp/111 tcp/111

Client Ports:

•

any

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Portmap)

### service: postgres
PostgreSQL

Example:

```
  server postgres accept
```

Service Type:

•

simple

Server Ports:

•

tcp/5432

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Postgres)

### service: pptp
Point-to-Point Tunneling Protocol

Example:

```
  server pptp accept
```

Service Type:

•

simple

Server Ports:

•

tcp/1723

Client Ports:

•

default

Netfilter Modules

•

nf_conntrack_pptp CONFIG_NF_CONNTRACK_PPTP (http://cateee.net/lkddb/web-lkddb/NF_CONNTRACK_PPTP.html)

•

nf_conntrack_proto_gre CONFIG_NF_CT_PROTO_GRE (http://cateee.net/lkddb/web-lkddb/NF_CT_PROTO_GRE.html)

Netfilter NAT Modules

•

nf_nat_pptp CONFIG_NF_NAT_PPTP (http://cateee.net/lkddb/web-lkddb/NF_NAT_PPTP.html)

•

nf_nat_proto_gre CONFIG_NF_NAT_PROTO_GRE (http://cateee.net/lkddb/web-lkddb/NF_NAT_PROTO_GRE.html)

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Pptp)

### service: privoxy
Privacy Proxy

Example:

```
  server privoxy accept
```

Service Type:

•

simple

Server Ports:

•

tcp/8118

Client Ports:

•

default

Links

•

Homepage (http://www.privoxy.org/)

### service: radius
Remote Authentication Dial In User Service (RADIUS)

Example:

```
  server radius accept
```

Service Type:

•

simple

Server Ports:

•

udp/1812 udp/1813

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/RADIUS)

### service: radiusold
Remote Authentication Dial In User Service (RADIUS)

Example:

```
  server radiusold accept
```

Service Type:

•

simple

Server Ports:

•

udp/1645 udp/1646

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/RADIUS)

### service: radiusoldproxy
Remote Authentication Dial In User Service (RADIUS)

Example:

```
  server radiusoldproxy accept
```

Service Type:

•

simple

Server Ports:

•

udp/1647

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/RADIUS)

### service: radiusproxy
Remote Authentication Dial In User Service (RADIUS)

Example:

```
  server radiusproxy accept
```

Service Type:

•

simple

Server Ports:

•

udp/1814

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/RADIUS)

### service: rdp
Remote Desktop Protocol

Example:

```
  server rdp accept
```

Service Type:

•

simple

Server Ports:

•

tcp/3389

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Remote_Desktop_Protocol)

Notes

Remote Desktop Protocol is also known also as Terminal Services.

### service: rndc
Remote Name Daemon Control

Example:

```
  server rndc accept
```

Service Type:

•

simple

Server Ports:

•

tcp/953

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Rndc)

### service: rsync
rsync protocol

Example:

```
  server rsync accept
```

Service Type:

•

simple

Server Ports:

•

tcp/873 udp/873

Client Ports:

•

default

Links

•

Homepage (http://rsync.samba.org/)

•

Wikipedia (http://en.wikipedia.org/wiki/Rsync)

### service: rtp
Real-time Transport Protocol

Example:

```
  server rtp accept
```

Service Type:

•

simple

Server Ports:

•

udp/10000:20000

Client Ports:

•

any

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Real-time_Transport_Protocol)

Notes

RTP ports are generally all the UDP ports. This definition narrows down RTP ports to UDP 10000 to 20000.

### service: samba
Samba

Example:

```
  server samba accept
```

Service Type:

•

complex

Server Ports:

•

many

Client Ports:

•

default

Links

•

Homepage (http://www.samba.org/)

•

Wikipedia (http://en.wikipedia.org/wiki/Samba_(software))

Notes

The samba service automatically sets all the rules for netbios_ns, netbios_dgm, netbios_ssn and microsoft_ds.

Please refer to the notes of the above services for more information.

NETBIOS initiates based on the broadcast address of an interface (request goes to broadcast address) but the server responds from its own IP address. This makes the "server samba accept" statement drop the server reply, because of the way the iptables connection tracker works.

This service definition includes a hack, that allows a Linux samba server to respond correctly in such situations, by allowing new outgoing connections from the well known netbios_ns port to the clients high ports.

However, for clients and routers this hack is not applied because it would open all unprivileged ports to the samba server. The only solution to overcome the problem in such cases (routers or clients) is to build a trust relationship between the samba servers and clients.

### service: sane
SANE Scanner service

Service Type:

•

simple

Server Ports:

•

tcp/6566

Client Ports:

•

default

Netfilter Modules

•

nf_conntrack_sane CONFIG_NF_CONNTRACK_SANE (http://cateee.net/lkddb/web-lkddb/NF_CONNTRACK_SANE.html)

Netfilter NAT Modules

•

N/A

Links

•

Homepage (http://www.sane-project.org/)

### service: sip
Session Initiation Protocol

Example:

```
  server sip accept
```

Service Type:

•

simple

Server Ports:

•

tcp/5060 udp/5060

Client Ports:

•

5060 default

Netfilter Modules

•

nf_conntrack_sip CONFIG_NF_CONNTRACK_SIP (http://cateee.net/lkddb/web-lkddb/NF_CONNTRACK_SIP.html)

Netfilter NAT Modules

•

nf_nat_sip CONFIG_NF_NAT_SIP (http://cateee.net/lkddb/web-lkddb/NF_NAT_SIP.html)

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Session_Initiation_Protocol)

Notes

SIP (http://www.voip-info.org/wiki/view/SIP) is an IETF standard protocol (RFC 2543) for initiating interactive user sessions involving multimedia elements such as video, voice, chat, gaming, etc. SIP works in the application layer of the OSI communications model.

### service: smtp
Simple Mail Transport Protocol

Example:

```
  server smtp accept
```

Service Type:

•

simple

Server Ports:

•

tcp/25

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol)

### service: smtps
Secure Simple Mail Transport Protocol

Example:

```
  server smtps accept
```

Service Type:

•

simple

Server Ports:

•

tcp/465

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/SMTPS)

### service: snmp
Simple Network Management Protocol

Example:

```
  server snmp accept
```

Service Type:

•

simple

Server Ports:

•

udp/161

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Simple_Network_Management_Protocol)

### service: snmptrap
SNMP Trap

Example:

```
  server snmptrap accept
```

Service Type:

•

simple

Server Ports:

•

udp/162

Client Ports:

•

any

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Simple_Network_Management_Protocol#Trap)

Notes

An SNMP trap is a notification from an agent to a manager.

### service: socks
SOCKet Secure

Example:

```
  server socks accept
```

Service Type:

•

simple

Server Ports:

•

tcp/1080 udp/1080

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/SOCKS)

Notes

See also RFC 1928 (http://www.ietf.org/rfc/rfc1928.txt).

### service: squid
Squid Web Cache

Example:

```
  server squid accept
```

Service Type:

•

simple

Server Ports:

•

tcp/3128

Client Ports:

•

default

Links

•

Homepage (http://www.squid-cache.org/)

•

Wikipedia (http://en.wikipedia.org/wiki/Squid_(software))

### service: ssh
Secure Shell Protocol

Example:

```
  server ssh accept
```

Service Type:

•

simple

Server Ports:

•

tcp/22

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Secure_Shell)

### service: stun
Session Traversal Utilities for NAT

Example:

```
  server stun accept
```

Service Type:

•

simple

Server Ports:

•

udp/3478 udp/3479

Client Ports:

•

any

Links

•

Wikipedia (http://en.wikipedia.org/wiki/STUN)

Notes

STUN (http://www.voip-info.org/wiki/view/STUN) is a protocol for assisting devices behind a NAT firewall or router with their packet routing.

### service: submission
SMTP over SSL/TLS submission

Example:

```
  server submission accept
```

Service Type:

•

simple

Server Ports:

•

tcp/587

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol)

Notes

Submission is essentially normal SMTP with an SSL/TLS negotiation.

### service: sunrpc
Open Network Computing Remote Procedure Call - Port Mapper

Alias for portmap

### service: swat
Samba Web Administration Tool

Example:

```
  server swat accept
```

Service Type:

•

simple

Server Ports:

•

tcp/901

Client Ports:

•

default

Links

•

Homepage (http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/SWAT.html)

### service: syslog
Syslog Remote Logging Protocol

Example:

```
  server syslog accept
```

Service Type:

•

simple

Server Ports:

•

udp/514

Client Ports:

•

514 default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Syslog)

### service: telnet
Telnet

Example:

```
  server telnet accept
```

Service Type:

•

simple

Server Ports:

•

tcp/23

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Telnet)

### service: tftp
Trivial File Transfer Protocol

Example:

```
  server tftp accept
```

Service Type:

•

simple

Server Ports:

•

udp/69

Client Ports:

•

default

Netfilter Modules

•

nf_conntrack_tftp CONFIG_NF_CONNTRACK_TFTP (http://cateee.net/lkddb/web-lkddb/NF_CONNTRACK_TFTP.html)

Netfilter NAT Modules

•

nf_nat_tftp CONFIG_NF_NAT_TFTP (http://cateee.net/lkddb/web-lkddb/NF_NAT_TFTP.html)

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Trivial_File_Transfer_Protocol)

### service: time
Time Protocol

Example:

```
  server time accept
```

Service Type:

•

simple

Server Ports:

•

tcp/37 udp/37

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Time_Protocol)

### service: timestamp
ICMP Timestamp

Example:

```
  server timestamp accept
```

Service Type:

•

complex

Server Ports:

•

N/A

Client Ports:

•

N/A

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol#Timestamp)

Notes

This services matches requests of protocol ICMP and type timestamp-request (TYPE=13) and their replies of type timestamp-reply (TYPE=14).

The timestamp service is stateful.

### service: tomcat
HTTP alternate port

Alias for httpalt

### service: upnp
Universal Plug and Play

Example:

```
  server upnp accept
```

Service Type:

•

simple

Server Ports:

•

udp/1900 tcp/2869

Client Ports:

•

default

Links

•

Homepage (http://upnp.sourceforge.net/)

•

Wikipedia (http://en.wikipedia.org/wiki/Universal_Plug_and_Play)

Notes

For a Linux implementation see: Linux IGD (http://linux-igd.sourceforge.net/).

### service: uucp
Unix-to-Unix Copy

Example:

```
  server uucp accept
```

Service Type:

•

simple

Server Ports:

•

tcp/540

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/UUCP)

### service: vmware
vmware

Example:

```
  server vmware accept
```

Service Type:

•

simple

Server Ports:

•

tcp/902

Client Ports:

•

default

Notes

Used from VMWare 1 and up. See the VMWare KnowledgeBase (http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1012382).

### service: vmwareauth
vmwareauth

Example:

```
  server vmwareauth accept
```

Service Type:

•

simple

Server Ports:

•

tcp/903

Client Ports:

•

default

Notes

Used from VMWare 1 and up. See the VMWare KnowledgeBase (http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1012382).

### service: vmwareweb
vmwareweb

Example:

```
  server vmwareweb accept
```

Service Type:

•

simple

Server Ports:

•

tcp/8222 tcp/8333

Client Ports:

•

default

Notes

Used from VMWare 2 and up. See VMWare Server 2.0 release notes (http://www.vmware.com/support/server2/doc/releasenotes_vmserver2.html) and the VMWare KnowledgeBase (http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1012382).

### service: vnc
Virtual Network Computing

Example:

```
  server vnc accept
```

Service Type:

•

simple

Server Ports:

•

tcp/5900:5903

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Virtual_Network_Computing)

Notes

VNC is a graphical desktop sharing protocol.

### service: webcache
HTTP alternate port

Alias for httpalt

### service: webmin
Webmin Administration System

Example:

```
  server webmin accept
```

Service Type:

•

simple

Server Ports:

•

tcp/10000

Client Ports:

•

default

Links

•

Homepage (http://www.webmin.com/)

### service: whois
WHOIS Protocol

Example:

```
  server whois accept
```

Service Type:

•

simple

Server Ports:

•

tcp/43

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/Whois)

### service: xbox
Xbox Live

Example:

```
  client xbox accept
```

Service Type:

•

complex

Server Ports:

•

many

Client Ports:

•

default

Notes

Definition for the Xbox live service.

See program source for contributor details.

### service: xdmcp
X Display Manager Control Protocol

Example:

```
  server xdmcp accept
```

Service Type:

•

simple

Server Ports:

•

udp/177

Client Ports:

•

default

Links

•

Wikipedia (http://en.wikipedia.org/wiki/X_display_manager_(program_type)#X_Display_Manager_Control_Protocol)

Notes

See Gnome Display Manager (http://www.jirka.org/gdm-documentation/x70.html) for a discussion about XDMCP and firewalls (Gnome Display Manager is a replacement for XDM).

## AUTHORS
FireHOL Team.